
Semidefinite relaxations for certifying robustness to adversarial examples
Despite their impressive performance on diverse tasks, neural networks f...
read it

Gradient Masking Causes CLEVER to Overestimate Adversarial Perturbation Size
A key problem in research on adversarial examples is that vulnerability ...
read it

A lower bound on the positive semidefinite rank of convex bodies
The positive semidefinite rank of a convex body C is the size of its sma...
read it

A Primer on MultiNeuron Relaxationbased Adversarial Robustness Certification
The existence of adversarial examples poses a real danger when deep neur...
read it

Theoretically Principled Tradeoff between Robustness and Accuracy
We identify a tradeoff between robustness and accuracy that serves as a...
read it

Defending Against Adversarial Examples with KNearest Neighbor
Robustness is an increasingly important property of machine learning mod...
read it

Automatic Perturbation Analysis on General Computational Graphs
Linear relaxation based perturbation analysis for neural networks, which...
read it
On the Tightness of Semidefinite Relaxations for Certifying Robustness to Adversarial Examples
The robustness of a neural network to adversarial examples can be provably certified by solving a convex relaxation. If the relaxation is loose, however, then the resulting certificate can be too conservative to be practically useful. Recently, a less conservative robustness certificate was proposed, based on a semidefinite programming (SDP) relaxation of the ReLU activation function. In this paper, we give a geometric analysis for the tightness of this relaxation. We show that, for a leastsquares restriction of the usual adversarial attack problem, the SDP relaxation is tight over a single hidden layer under reasonable assumptions. The resulting robustness certificate is exact, meaning that it provides a lowerbound on the size of the smallest adversarial perturbation, as well as a globally optimal perturbation that attains the lowerbound. For several hidden layers, the SDP relaxation is not usually tight; we give an explanation using the underlying hyperbolic geometry. We experimentally confirm our theoretical insights using a generalpurpose interiorpoint method and a custom rank2 BurerMonteiro algorithm.
READ FULL TEXT
Comments
There are no comments yet.